Authentication

MADIAD Hub uses API keys to authenticate requests. Every call must include your key in the Authorization header as a Bearer token.

Authorization: Bearer mdc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Requests without a valid key return 401 Unauthorized.

Create a key

A key is shown only once, at creation. Copy it immediately and store it in a secret manager. If you lose it, revoke the key and create a new one.

Part	Example	Meaning
Prefix	`mdc_live_`	Environment — `live` keys publish real posts
Body	`a1b2c3…`	The secret. Only the prefix is shown in the dashboard after creation

The dashboard lists each key by its prefix and name, so you can identify a key without exposing the secret.

Send it as a Bearer token on every request:

curl https://api.madiad.com/v1/connections/status \
  -H "Authorization: Bearer $MADIAD_API_KEY"

Store the key in an environment variable — never hard-code it in source or ship it in client-side code:

export MADIAD_API_KEY="mdc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Treat keys like passwords:

Rotate periodically — create a new key, update your apps, then revoke the old one.
Revoke immediately if a key is exposed. Revocation takes effect within seconds and cannot be undone.
Use a separate key per integration (one per app, server, or workflow) so revoking one never breaks the others.

Need to authorize a social account rather than an API request? That happens per profile — see Profiles.